CVE-2026-40164 jq is a command-line JSON processor
Description
jq is a command-line JSON processor. Before commit 0c7d133c3c7e37c00b6d46b658a02244fdd3c784, jq used MurmurHash3 with a hardcoded, publicly visible seed (0x432A9843) for all JSON object hash table operations, which allowed an attacker to precompute key collisions offline. By supplying a crafted JSON object (~100 KB) where all keys hashed to the same bucket, hash table lookups degraded from O(1) to O(n), turning any jq expression into an O(n²) operation and causing significant CPU exhaustion. This affected common jq use cases such as CI/CD pipelines, web services, and data processing scripts, and was far more practical to exploit than existing heap overflow issues since it required only a small payload. This issue has been patched in commit 0c7d133c3c7e37c00b6d46b658a02244fdd3c784.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| jq | Versions not published | |
| Red Hat OpenShift Container Platform 4.12 412.86 | earliest → < 412.86.202606140301-0 | 412.86.202606140301-0 |
| Red Hat OpenShift Container Platform 4.13 413.92 | earliest → < 413.92.202606160406-0 | 413.92.202606160406-0 |
| Red Hat OpenShift Container Platform 4.15 415.92 | earliest → < 415.92.202606030318-0 | 415.92.202606030318-0 |
| Red Hat OpenShift Container Platform 4.16 416.94 | earliest → < 416.94.202606051757-0 | 416.94.202606051757-0 |
| Red Hat OpenShift Container Platform 4.18 418.94 | earliest → < 418.94.202606051320-0 | 418.94.202606051320-0 |
| Red Hat OpenShift Container Platform 4.19 4.19 | earliest → < 4.19.9.6.202606031700-0 | 4.19.9.6.202606031700-0 |
| Red Hat Enterprise Linux AppStream (v. 8) | Versions not published | |
| Red Hat Enterprise Linux AppStream AUS (v.8.4) | Versions not published |
Show the 39 other branches Hide the 39 other branches
References
- github.com github.com
- github.com github.com
Timeline
- Published
- Last modified